REP27 · EU representative · Kazakhstan
Article 27 GDPR · Kazakhstan
If your company is established in Kazakhstan and you offer goods or services to people in the European Union — or you monitor their behaviour — Article 27 of the GDPR requires you to designate, in writing, a representative inside the Union. We are that representative: named in your privacy notice, reachable by all 27 supervisory authorities, and verifiable by anyone holding the code on your certificate.
Law 94-V governs personal data in Kazakhstan. It has no bearing on Article 27, which applies because your customers are in the European Union and your establishment is not.
€525,000The Dutch supervisory authority fined Locatefamily.com €525,000 for failing to designate an EU representative, and added periodic penalties until the company complied. No other breach was needed.
Energy and mining technology, logistics on the trans-Caspian route, fintech, and software firms serving European clients.
One sale might be occasional. A product that European customers can buy today, tomorrow and next month is not, and Article 27(2)(a) does not apply.
Many files start with a product built for a home market that quietly acquired European users. Intent is not the test; the presence of the users is.
European controllers are audited on their processors. That is why the designation appears in questionnaires before it appears in enforcement.
Law 94-V governs personal data in Kazakhstan, with localisation requirements for certain data. It has no bearing on Article 27, which applies because your customers are in the Union.
the Ministry of Digital Development, under Law 94-V. None of them can receive a request under Article 27(4) on your behalf, and none of them appears in your privacy notice for European purposes.
Kazakh companies reach the Union through energy and mining technology, logistics on the trans-Caspian corridor, fintech, and software firms serving European clients.
One designation, published in your notice, verifiable by anyone with the code. Requests logged and forwarded within two business days, with the GDPR deadline already counted for you.
The written designation Article 27(1) requires, countersigned by Europe Services, SE and signed electronically under eIDAS, naming the member states covered.
A certificate with a QR code and a public verification page, so a regulator, a client or a buyer can confirm the designation is live at that moment.
A dedicated address, inbox and form. Every request from a data subject or an authority is logged and forwarded to you within two business days.
If you process personal data of people in the Union — drivers, consignees, contact persons at EU companies — Article 3(2) can apply. The free check gives you a first answer.
Localisation and representation are different questions. Storing data in Kazakhstan does not remove the need for someone in the Union to receive a request.
Usually yes, and Article 27 applies to processors caught by Article 3(2) exactly as to controllers.
The designation letter and certificate are issued within 24 working hours of the form and payment, after a person reviews the file. Higher-risk sectors take up to five business days.
From €290 a year, billed annually in advance and renewing automatically until you cancel before the renewal date. No fee per request from the Standard plan up.
No. Under EDPB guidance one entity cannot be both. We are the contact point under Article 27(4): we receive, log and forward, hold your Article 30 records, and never answer on the merits or give legal advice.
Kazakh files are mostly logistics and energy, and both underestimate how much personal data sits in shipping and site-access systems.
Free check first: we read your public privacy notice and tell you in ten seconds whether a representative is named. If one is, we say so and you close the tab.
Run the free check